mako-as4

BDEW MaKo AS4 profile — sign + encrypt with BrainpoolP256r1.

Encodes the BDEW AS4-Profil v1.2 requirements on top of asx-rs, providing pre-configured P-Modes, security policy constants, a bilateral partner directory, and test helpers for the German electricity and gas AS4 network.

BDEW AS4-Profil v1.2 requirements

All algorithms are auto-detected — supply an EC (BrainpoolP256r1) signing key and asx-rs v0.7 automatically uses ECDSA-SHA256. Supply an EC encryption certificate and asx-rs v0.7 automatically uses ECDH-ES + ConcatKDF + AES-128-GCM.

AS4 became mandatory for electricity on 1 April 2024 (BK6-22-024) and for gas on 1 April 2025 (BK7-22-023).

Certificate triplet

BDEW requires three separate X.509 keypairs, all using BrainpoolP256r1:

mTLS certificate         WS-Security signing cert    XML Encryption cert
KeyUsage: digitalSig     KeyUsage: digitalSignature  KeyUsage: keyAgreement
        ↕ mTLS                  ↕ sign payload              ↕ ECDH-ES
   HTTPS transport          outbound messages           recipient's pubkey

API overview

Quick start

use mako_as4::{BdewAs4Profile, BdewAction, bdew_pmode, constants};

// 1. Register bilateral P-Modes for each trading partner.
let mut profile = BdewAs4Profile::new();
profile.register_partner_all_actions(
    "9900000000001",
    "https://partner.example/as4/inbox",
);

// 2. Register the partner's EC encryption certificate (BrainpoolP256r1).
//    asx-rs v0.7 auto-selects ECDH-ES when an EC cert is supplied.
let partner_encrypt_cert_pem: Vec<u8> = std::fs::read("/etc/partner/encrypt.pem").unwrap_or_default();
profile.register_partner_encryption_cert("9900000000001", partner_encrypt_cert_pem);

// 3. Fail-fast at startup.
profile.validate().expect("BDEW MaKo profile must satisfy all security invariants");

// 4. Build inbound push policy with own decryption key.
let own_decrypt_key_pem: Vec<u8> = std::fs::read("/etc/certs/as4-encrypt.key.pem").unwrap_or_default();
let push_policy = mako_as4::bdew_push_policy(Some(own_decrypt_key_pem));
// push_policy.require_encrypted_inbound == true (rejects unencrypted inbound)

Testing without WIRK certificates

Enable the testing feature to generate BrainpoolP256r1 test keypairs in memory:

[dev-dependencies]
mako-as4 = { version = "0.11", features = ["testing"] }

use mako_as4::testing::{BdewTestPki, MockAs4Endpoint};

// All three keypairs (TLS, signing, encryption) on BrainpoolP256r1.
let pki = BdewTestPki::generate("Test NB 9900357000004");

// In-process mock AS4 server — no WIRK certs needed.
# async fn example() {
let endpoint = MockAs4Endpoint::bind("127.0.0.1:0").await.unwrap();
let url = endpoint.local_url(); // "http://127.0.0.1:PORT/as4/inbox"
# }

Feature flags

Regulatory references

Related crates

Quick start

use mako_as4::{BdewAs4Profile, BdewAction, bdew_pmode, constants};

// Build a profile and register bilateral P-Modes for each trading partner.
let mut profile = BdewAs4Profile::new();
profile
    .register_pmode(bdew_pmode("pm-utilmd-a", "9900000000001", BdewAction::Utilmd))
    .register_pmode(bdew_pmode("pm-aperak-a", "9900000000001", BdewAction::Aperak));

// Fail-fast at startup — verifies all security invariants.
profile.validate().expect("BDEW MaKo profile must satisfy all security invariants");

// Resolve a P-Mode at send time.
let pm = profile.resolve_pmode(
    "9900000000001",
    constants::SERVICE,
    &BdewAction::Utilmd.as_uri(),
);
assert!(pm.is_some());

Feature flags

Regulatory references

• BDEW AS4 Kommunikationshandbuch — transport and security profile specification
• BNetzA BK6-22-024 — mandatory AS4 adoption for electricity (effective 2024-04-01)
• BNetzA BK7-22-023 — mandatory AS4 adoption for gas (effective 2025-04-01)
• OASIS ebMS3 / AS4 Profile — messaging standard

Related crates